All Products
Search

This Product

    NAT Gateway:VPC NAT Gateway

    Document Center

    NAT Gateway:VPC NAT Gateway

    Last Updated:May 28, 2026

    A VPC NAT Gateway translates private IPv4 addresses within a VPC to NAT IP addresses. This enables communication between networks with overlapping CIDR blocks and enables resources to be accessed from specified addresses.

    • Resolve private network address conflicts: VPCs with overlapping CIDR blocks cannot be interconnected. To resolve this, add a secondary CIDR block and use a VPC NAT Gateway for address translation.

    • Use specified addresses for access: In regulated industries such as finance and securities, cloud services use a VPC NAT Gateway to access on-premises data centers from a fixed, specified private IP address.

    A VPC NAT Gateway supports two types of disaster recovery:

    Single-zone disaster recovery is available in all regions that support NAT Gateway. To use this feature, contact your account manager to request it.

    • Cross-zone disaster recovery (Default): The NAT gateway is deployed redundantly across multiple availability zones. If one availability zone fails, traffic is automatically failed over.

    • Single-zone disaster recovery: The NAT gateway is deployed within a single availability zone, ensuring high availability only within that availability zone. The instance fee is approximately 50% of the cross-zone model, and the Capacity Unit (CU) fee is about 80% of that for the cross-zone model.

    How it works

    The following example shows how to establish communication between cloud services and an on-premises data center by using fixed, specified private IP addresses.

    • Cloud services access an on-premises data center: Multiple ECS instances in a VPC access an on-premises data center by using a specified NAT IP address.

      1. Route forwarding: Access requests from an ECS instance are forwarded to the VPC NAT Gateway according to the route configured in the VPC route table.

      2. SNAT (Source Network Address Translation): When the VPC NAT Gateway receives the packet, it translates the packet's source IP address from the ECS instance IP address (e.g., 192.168.1.10) to a specified NAT IP address (e.g., 192.168.10.2) based on the configured SNAT entry. The gateway records this mapping in a session table.

      3. Send to the peer private network: The translated packet is sent to the on-premises data center. To the data center, the request originates from the NAT IP address, not the ECS instance.

      4. Response and reverse translation: The response packet from the on-premises data center has the NAT IP address as its destination. The VPC NAT Gateway uses the session table to restore the original private IP address and forwards the packet back to the source ECS instance.

    • An on-premises data center accesses cloud services: The data center initiates a request to the fixed NAT IP address (192.168.10.2). The VPC NAT Gateway uses a DNAT entry to translate the destination IP address from the NAT IP address to the private IP address of the ECS instance that provides the service (e.g., 192.168.1.10), directing inbound traffic to the correct server.

    Note that a VPC NAT Gateway only performs address translation and does not determine traffic flow. The VPC route table controls whether traffic is sent to the NAT gateway and where it is directed after translation.

    Connectivity with other VPCs or on-premises data centers must be established by using products such as Cloud Enterprise Network (CEN) or Express Connect.

    • Configure outbound routes from the VPC (VPC to peer private network): Ensure that a route is added to the VPC route table with the destination as the peer network (such as the on-premises data center) and the next hop as the VPC NAT Gateway. This ensures that outbound requests from instances in the VPC are forwarded to the NAT gateway for SNAT.

    • Advertise the NAT IP CIDR block: If you use a custom NAT IP CIDR block, add a route to the VPC route table with the destination as this CIDR block and the next hop as the VPC NAT Gateway. This declares ownership of the CIDR block and ensures that inbound DNAT traffic and SNAT return traffic are routed correctly within the VPC.

    • Configure routes for the peer private network (peer private network to VPC): Ensure that the peer network has a route configured with the destination as the NAT IP CIDR block. This allows response packets and initiated requests from the peer private network to be forwarded to the NAT gateway.

    image

    Create a VPC NAT Gateway

    Console

    Go to the NAT Gateway - VPC NAT Gateway purchase page.

    • Billing Method: Pay-as-you-go.

    • Region: Select the region where you want to create the VPC NAT Gateway.

    • Disaster recovery type: Select the disaster recovery mode for the NAT gateway.

      • Cross-zone disaster recovery (Default): Deploys the gateway in a primary and a secondary availability zone. If the primary availability zone fails, traffic automatically fails over to the secondary one.

      • Single-zone disaster recovery: Deploys the gateway within the selected availability zone, providing high availability through device-level redundancy. The instance fee is approximately 50% of the cross-zone model, and the Capacity Unit (CU) fee is about 80% of that for the cross-zone model.

    • Network and availability zone: Select the VPC and vSwitch for the VPC NAT Gateway. For easier route management, we recommend that you plan and use a dedicated vSwitch for the VPC NAT Gateway.

    • Private IP: This serves as the default NAT IP address. You can specify a NAT IP address from the vSwitch's CIDR block (the default NAT IP CIDR block). If you do not specify an IP address, the system assigns one.

    • Private IP Prefix: This allows you to create NAT IP addresses in batches. First, create a reserved CIDR block for the gateway's vSwitch. The gateway then divides the reserved block into IP prefixes with a /28 mask. After you specify an IP prefix, the system adds all 16 addresses in that prefix as NAT IP addresses for the NAT gateway.

    API

    Call the CreateNatGateway operation to create a VPC NAT Gateway. Use the AvailabilityMode parameter to specify the disaster recovery type: CrossAZ (default, cross-zone disaster recovery) or SingleAZ (single-zone disaster recovery).

    Configure NAT IP addresses and CIDR blocks

    NAT IP addresses are used in SNAT and DNAT entries to replace the private IP addresses of ECS instances during address translation, serving as a unified source or destination address. NAT IP addresses must be allocated from NAT IP CIDR blocks.

    • Default NAT IP CIDR block: By default, the system uses the CIDR block of the vSwitch associated with the VPC NAT Gateway as the default NAT IP CIDR block.

      • The private IP address configured during creation serves as the default NAT IP address. You can specify this address, or the system will assign one if not specified. You can add more NAT IP addresses later.

      • You can configure a private IP prefix from a reserved CIDR block of the vSwitch to create NAT IP addresses in batches.

    • Create a new NAT IP CIDR block: Allocate NAT IP addresses from a CIDR block that is different from the one used by the associated vSwitch.

      • We recommend that you use the RFC 1918 private address ranges (10.0.0.0/16, 172.16.0.0/16, and 192.168.0.0/16) or their subnets as address blocks. The supported subnet mask length is from 16 to 32 bits.

      • If you need to use a public CIDR block, you must use a user CIDR block to ensure it is within the VPC's address range before using it as a NAT IP CIDR block.

      • The new address block cannot overlap with the private CIDR block of the VPC where the VPC NAT Gateway resides. If you need to translate a private address to another address within the VPC's private CIDR block, create a new vSwitch within that block and then create a new VPC NAT Gateway in that vSwitch to provide the address translation service.

    Console

    NAT IP CIDR block

    • Default NAT IP CIDR block: The system uses the CIDR block of the VPC NAT Gateway's associated vSwitch by default. This block cannot be deleted.

    • Create a new NAT IP CIDR block: Go to the VPC NAT Gateway page, click the ID of the target VPC NAT Gateway instance to open its details page, select the NAT IP Address tab, and then click Create CIDR Block.

    NAT IP address

    • Add from the default NAT IP CIDR block:

      • When you create a VPC NAT Gateway, the configured private IP address serves as the default NAT IP address. You can specify this IP address or let the system assign one automatically. The default NAT IP address cannot be deleted.

      • Add NAT IP addresses individually: Go to the VPC NAT Gateway page, click the ID of the target VPC NAT Gateway instance to open its details page, select the NAT IP Address tab, and then click Add NAT IP Address.

        • Select CIDR Block: Select the default NAT IP CIDR block for the VPC NAT Gateway.

        • Allocation Method: Choose Randomly Allocate or choose Manually Allocate and specify an IP Address from the selected address block.

      • Add NAT IP addresses in batches by using an IP prefix: Go to the VPC NAT Gateway page, click the ID of the target VPC NAT Gateway instance, go to the NAT IP Address tab, select NAT IP Prefix, and then click Add IP Prefix.

        • To add in batches: Select Random Assignment and specify the number of IP prefixes to assign. The system randomly adds the specified number of unassigned /28 IP prefixes from the reserved CIDR block of the gateway's vSwitch.

        • To add individually: Select Manual Assignment and specify an unassigned /28 IP prefix from the reserved CIDR block of the gateway's vSwitch.

    • Add from a new NAT IP CIDR block: Click the ID of the target VPC NAT Gateway instance to open its details page, select the NAT IP Address tab, and then click Add NAT IP Address.

      • Select CIDR Block: Select a new NAT IP CIDR block under the VPC NAT Gateway.

      • Allocation Method: Choose Randomly Allocate or choose Manually Allocate and specify an IP Address from the selected address block.

    API

    Configure SNAT entries

    Console

    Go to the VPC NAT Gateway page, find the target VPC NAT Gateway instance, and click SNAT Management in the Actions column. Then, click Create SNAT Entry.

    • SNAT entry granularity: Select the scope of the SNAT rule based on your management needs.

      • VPC granularity: All ECS instances in the associated VPC can access peer private networks through the configured SNAT rule.

      • vSwitch granularity: Only ECS instances in the specified vSwitch can access peer private networks.

      • ECS granularity: Only the specified ECS instances or elastic network interfaces can access peer private networks.

      • Custom CIDR block granularity: Resources within the specified CIDR block can access peer private networks.

    • Select NAT IP Address: Select one or more NAT IP addresses from the drop-down list to access peer private networks. You can also select Create NAT IP Address from the list to create and select a new one.

    • NAT IP affinity: If you select multiple NAT IP addresses and do not enable affinity, a single private IP address accessing a single destination IP address may use different NAT IP addresses. If you enable affinity, connections from the same private IP to the same destination IP consistently use the same NAT IP address. However, if the number of concurrent connections to a single destination is too high, port allocation may fail. You must monitor the number of dropped packets due to port allocation failures.

    After the entry is created, you can click Edit in the Actions column for the entry to modify the NAT IP address and NAT IP affinity settings.

    API

    Configure DNAT entries

    Important

    After you create a DNAT entry, you must ensure that the inbound rules of the security group for the destination ECS instance allow traffic on the mapped port. For example, if a DNAT entry maps frontend port 30081 to port 30081 on an ECS instance, you must add an inbound rule to the security group: select Custom TCP for Protocol Type, enter the mapped port range (e.g., 30081/30081), and set the authorization object to 0.0.0.0/0 or a specific source IP range. If the security group does not allow traffic on the corresponding port, attempts to access it from peer private networks will time out, even if the DNAT entry is correctly configured.

    Console

    Go to the VPC NAT Gateway page, find the target VPC NAT Gateway instance, and click DNAT Management in the Actions column. Then, click Create DNAT Entry.

    • Select NAT IP Address: Select the NAT IP address to be accessed by peer private networks. A single NAT IP address can be used for both a DNAT entry (port mapping) and an SNAT entry simultaneously.

    • Select Private IP Address: Select the private IP address of the backend server that will receive the traffic. You can select it by specifying an ECS instance or an elastic network interface, or by entering the IP address manually.

    • Port settings: Configure the DNAT mapping.

      • Any Port: This creates an IP mapping. Any request to this NAT IP address is forwarded to the destination ECS instance.

        • The destination ECS instance can also use this NAT IP address to initiate outbound access to peer private networks. This NAT IP address cannot be used in any other DNAT or SNAT entries.

        • If a NAT gateway has both a DNAT IP mapping and an SNAT entry configured, the ECS instance prioritizes the NAT IP address from the DNAT IP mapping for outbound access.

      • Specific port: This creates a port mapping. Requests to the NAT IP address on a specific port and protocol are forwarded to a specific port on the destination ECS instance. Configure the Frontend Port (the port on the NAT IP address accessed by the peer private network), the Backend Port (the port on the destination ECS instance), and the Protocol Type.

        • The port number must be between 1 and 65535. Forwarding within a port range is not supported.

        • If the selected NAT IP address is already used in an SNAT entry and you need to set a port greater than 1024, you must Enable Port Breaking. This is because the default SNAT port range is 1025–65535.

          Important

          Enabling port breaking may cause momentary disconnections for some existing SNAT connections. These connections can be restored by reconnecting. Proceed with caution.

    After the entry is created, you can click Edit in the Actions column for the entry to modify the NAT IP address, private IP address, and port settings.

    API

    Clean up resources

    You are charged an instance fee from the moment a VPC NAT Gateway is created until it is released. A Capacity Unit (CU) fee is also charged when it processes traffic. To avoid unnecessary costs, clean up resources when they are no longer needed by following these steps:

    Console

    1. Delete configured entries: On the instance details page, go to the SNAT Management and DNAT Management tabs and delete all configured entries.

    2. Delete NAT IP addresses:

      • For manually added NAT IP addresses: On the instance details page, go to the NAT IP tab, click Delete in the Actions column for the target NAT IP address, or select multiple NAT IP addresses and click Delete at the bottom of the page.

      • For NAT IP addresses added by using an IP prefix: On the instance details page, go to the NAT IP tab, select NAT IP Prefix, and click Delete in the Actions column for the target IP prefix. This removes all associations and deletes the IP prefix and all NAT IP addresses created with it.

    3. Delete a new NAT IP CIDR block: On the instance details page, go to the NAT IP tab and click the 删除 icon next to the target NAT IP CIDR block.

    4. Delete the VPC NAT Gateway: Click Delete in the Actions column of the target instance.

      If NAT IP addresses and other entries have not been deleted, you can select Force Delete (Delete the NAT gateway and its resources) to have the system delete the instance and all related resources.

      On the instance details page, you can enable Deletion Protection to prevent accidental deletion. You must disable deletion protection before you can delete the instance.

    API

    1. Call the DeleteSnatEntry and DeleteForwardEntry operations to delete SNAT and DNAT entries, respectively.

    2. Call the DeleteNatIp operation to delete a NAT IP address.

    3. Call the DeleteNatIpCidr operation to delete a NAT IP CIDR block.

    4. Call the DeleteNatGateway operation to delete a VPC NAT Gateway.

    Production environment

    Best practices

    • Network planning: For easier route management, plan and use a dedicated vSwitch for the VPC NAT Gateway.

    • Fine-grained control: Use vSwitch-level or ECS-level SNAT entries to follow the principle of least privilege, granting outbound access only to resources that require it.

    • High availability and disaster recovery: A VPC NAT Gateway supports both cross-zone (default) and single-zone disaster recovery modes. In cross-zone mode, the gateway is deployed redundantly across availability zones for automatic failover. In single-zone mode, the gateway is deployed in a single availability zone at a lower cost, which is suitable for scenarios where your business services are already architected for availability zone separation.

    Risk mitigation

    • Security group configuration: A VPC NAT Gateway performs address translation, but you must still secure backend ECS instances by using security groups and network ACLs. Always configure strict inbound security group rules for your ECS instances, allowing traffic only on necessary ports.

    • Monitoring and alerts: Configure alerts for key metrics of the VPC NAT Gateway, such as concurrent connections and inbound/outbound bandwidth, to receive timely notifications and scale resources when bottlenecks are approaching.

    • Connection limits: If your services require a large number of connections to a single destination, be aware of the maximum number of concurrent connections (N × 55,000, where N is the number of NAT IP addresses in the SNAT entry). We recommend that you plan for a sufficient number of NAT IP addresses in advance and monitor the number of dropped packets due to port allocation failures.

    More information

    Billing

    You are charged an instance fee and a Capacity Unit (CU) fee for a VPC NAT Gateway.

    image

    Quotas

    Quota name

    Description

    Default quota

    Actions

    natgw_quota_nat_num_per_vpc

    Number of NAT gateways that can be created in a single VPC.

    5

    Go to the Quota Management page or Quota Center to request a quota increase.

    natgw_quota_nat_ip_num_per_vpc_nat

    Number of NAT IP addresses that can be created for each VPC NAT Gateway.

    15

    natgw_quota_snat_entry_num

    Number of SNAT entries that can be created for each NAT gateway.

    40

    natgw_quota_dnat_entry_num

    Number of DNAT entries that can be created for each NAT gateway.

    100